CVE-2026-70795

Analyzed Analyzed - Analysis Complete

Oracle Applications Platform Engineering Session Takeover

Publication date: 2026-08-18

Last updated on: 2026-08-28

Assigner: Oracle

Description

Vulnerability in the Oracle Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Oracle Applications Platform Engineering. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-28

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-70795

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	applications_platform_engineering	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle E-Business Suite's Applications Platform Engineering component. It allows an unauthenticated attacker with network access to potentially take over the system. The vulnerability has a high CVSS score of 8.1 due to its impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for unauthorized access or unusual activity in Oracle Applications Platform Engineering. Monitor logs for unexpected Oracle Net connections or session anomalies. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to fully compromise the Oracle Applications Platform Engineering system. This could lead to unauthorized access, data breaches, system manipulation, or complete system takeover.

Compliance Impact

This vulnerability allows unauthenticated attackers to compromise Oracle Applications Platform Engineering, potentially leading to unauthorized access and control. Such breaches could result in exposure of sensitive data, impacting compliance with GDPR (data protection) and HIPAA (healthcare data privacy).

Mitigation Strategies

Apply Oracle's official patches or updates for versions 12.2.3-12.2.15. Restrict network access to Oracle Net via firewalls. Review and disable unnecessary Oracle Applications Platform Engineering services.

Hi! I’m here to help you understand CVE-2026-70795. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70